22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873
- SHA256 22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873
Password
infected
Overview
overview
10Static
static
3Doc4736478...22.exe
windows7-x64
7Doc4736478...22.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Tandan7/vm...ts.dll
windows7-x64
1Tandan7/vm...ts.dll
windows10-2004-x64
1hyperbarba...-1.dll
windows7-x64
1hyperbarba...-1.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Doc4736478384775837642_JULY 2022.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Doc4736478384775837642_JULY 2022.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Tandan7/vm3ddevapi64-stats.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Tandan7/vm3ddevapi64-stats.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
hyperbarbarous/libbz2-1.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
hyperbarbarous/libbz2-1.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873
- Size 552KB
- Sample241221-tqb9cssphr
- SHA256 22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873
- MD5 eeb46b7b07db367c5aa16eb2e5272186
- SHA1 f470ccab46dc6ae665a15e7e4eeaf38a95eedf83
- SHA512 43b3140563a4c661e0a2e3eb4847e2cb8de01d8c127be885104898252e27d5ba2829b0423d33e622fb72cb73b307516104eb282ea34793cedfbc1aadad97d31f
- SSDEEP 12288:cHb6Eles513ryaAZbNfYBYynjhON5Adbs+nuHHAA:cHplB51bTA7fYBYuOEs+ux
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll unpack002/Tandan7/vm3ddevapi64-stats.dll unpack002/hyperbarbarous/libbz2-1.dll
File Explorer
-
22bdec013954160291c36c833a788b59c40d6758443418cf7a206f549f3d4873.zip 552KB
-
Doc4736478384775837642_JULY 2022.bin.exe 620KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Tandan7/vm3ddevapi64-stats.dll.dll 283KB
-
hyperbarbarous/POLITISOLDATS.bmp325KB
-
hyperbarbarous/changes-allow-symbolic.symbolic.png.png 177B
-
hyperbarbarous/libbz2-1.dll.dll 96KB
Doc4736478384775837642_JULY 2022.bin
- IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
- SHA256 73c90df4f49a9c5cc0b0e848dd4052b26335959618df392912982fd1ea15147b
- MD5 e2b4171a7b83f61ae32d10fba0d7316b
- SHA1 15ddef6a5b7b4417693d91003f4a2d03d826d71b
- SHA512 af096b104a33863acd449a84d1538e4f943d2a14e5c72b01c441019a52691c0ca7bafdec077ebb5290017f4306e1520885270297c0867cbbbea910ce047ab672
- SSDEEP 12288:5bZpw46GMbBMMtJdW/GqEUUt4ysV8ic6SnuyCLIu:5bZpz6GMxdWK8V8icluH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:b5:bd:a9:50:d0:03:5b:13:eb:a1:91:77:c7:39:5d:c7:4d:61:4d:b1:64:df:91:04:59:0a:3d:ac:de:68:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=prosecutors Blackrider1 Internetwork2\ ,O=Tegnestiftens,L=Saint-Symphorien-de-Marmagne,ST=Bourgogne-Franche-Comté,C=FR
Chains
Jul 5, 2022
Subject
CN=prosecutors Blackrider1 Internetwork2\ ,O=Tegnestiftens,L=Saint-Symphorien-de-Marmagne,ST=Bourgogne-Franche-Comté,C=FR
Serial Number
0e:ef:83:33:84:7f:c5:2e
Issuer
CN=prosecutors Blackrider1 Internetwork2\ ,O=Tegnestiftens,L=Saint-Symphorien-de-Marmagne,ST=Bourgogne-Franche-Comté,C=FR
Timespan
Jul 5, 2022 - Jul 5, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
13613
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Tandan7/vm3ddevapi64-stats.dll
- IMPHASH d51a07e37c7767898631ed629f49a908
- SHA256 a122dbf6e788346be9f602fb34008dea9bda31891b288819d479f70e4aa154a7
- MD5 b02a49f388eb67324cb730c9a95bb95a
- SHA1 bd50273568a6cf60ef813e795fc5c44c644f4e1f
- SHA512 8ea06f43c0d0c62295e1f752a2e67ce3379a8e700ed4f9ad5a962915296b7316644917f1893c7ff301b3d5519d827e22da92fcfe20e4e06196c96a97dfbda7ac
- SSDEEP 6144:KOrFH5ad1DK4zpFxa2jzen3PSB5OwLdm/rrLwbq:jrFH5+tdFxa2+n/iOTLwbq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
49424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\build\ob\bora-18379147\bora-vmsoft\build\release-x64\svga\wddm\src\devapi\Win8Stats\x64\bin\vm3ddevapi64-stats.pdb
gdi32
DeleteDC
CreateDCW
ole32
CoTaskMemFree
shell32
SHGetKnownFolderPath
user32
GetMonitorInfoW
EnumDisplayMonitors
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
EnumDisplayDevicesW
GetSystemMetrics
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
GetFileSizeEx
ReadConsoleW
CloseHandle
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
VerSetConditionMask
Sleep
GetCurrentProcessId
ProcessIdToSessionId
GetTickCount
GetTickCount64
VerifyVersionInfoW
FindClose
VirtualProtect
FindNextFileA
GetCurrentThreadId
GetLocalTime
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlCaptureStackBackTrace
GetCurrentProcess
FatalExit
RtlCaptureContext
CreateDirectoryW
CreateFileW
DeleteFileW
GetTempPathW
RaiseException
MoveFileW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
VirtualQuery
LoadLibraryExA
GetSystemInfo
FindFirstFileA
ReadFile
SetFilePointerEx
SetStdHandle
GetStringTypeW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
WideCharToMultiByte
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
LCMapStringW
GetStdHandle
GetFileType
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
winmm
timeGetTime
VM3DDevApiCleanupWrapper
VM3DDevApiInitWrapper
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mstv
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.msts
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.msti
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gehcont
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=159, id=261, version=27412,
count=1, productName=Unmarked objects (old),
count=10, id=259, version=29804,
count=14, id=260, version=29804,
count=29, id=261, version=29804,
count=1, id=261, productName=VS2015 UPD1 build 23506, version=23506,
count=3, id=261, version=26706,
count=1, id=259, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=262, version=26213,
count=15, id=257, version=26213,
count=136, id=1, productName=Unmarked objects,
count=18, id=260, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
hyperbarbarous/POLITISOLDATS.bmp
- SHA256 9f06bbf4825631b61d1b79d0454f60aa5170265b263272a7f5d34080fca6c895
- MD5 8a06d88af12d9812e9b650aedade5f0e
- SHA1 de2a77036a9aacc24beed776d87bb5ebe1761237
- SHA512 9fe7e08658dec7be5d6f8789ea2d121fe128dfbc271ec38efde5470c0eec4df6ea043cd204356f00fb7cf2a5de54b188e75e1fdf19408d0652ec3d04ac3d79c1
- SSDEEP 6144:9Yd4PeW48EtT8/2tgV8f5ytdHdWKg277tfqFyEzzYMl:9M4PeW4yFIMtJdWXyq1zYMl
- MD5 SHA1 SHA512 SSDEEP
hyperbarbarous/changes-allow-symbolic.symbolic.png
- SHA256 1dc17f1cd5a8df6ae78353edccc17bbbfd89fdf749180209e6d9f877fba2f55c
- MD5 7e88db6523343c4ade979cdfe2811d1c
- SHA1 e3bd191a10502d95da16c1c283f80147f9a406cd
- SHA512 94d5677860a9843985673e0152e450d373b751354907a0ea94bbdc1e018c78caf06d896cd5c71a600acff0a66bd55291b067ea3032ca91a248c36852a047eea5
- MD5 SHA1 SHA512
hyperbarbarous/libbz2-1.dll
- IMPHASH 9a18a813c4420cf0c271fa5e74a420f6
- SHA256 e996e8d18fa41407d80680adb9e416d916f7320e4559485ce3e3e5de811dca1d
- MD5 fd0b2bd2ae13d41de526b57e435c7fb5
- SHA1 55bb61c011180eaa172a83feefc38d8fe7c5498b
- SHA512 d7ebda50787aec915c6e3eab880a01dfc8925166c2cd2c1c70cc8ee505f17117f9e6ae9b1d57048df29bbd8705070618650a09ded64750e422a10e0365afa74e
- SSDEEP 1536:DDrxVw7IsNwmkMdKx711fvsOrTJ7X3OUTT4okcTzn8P8xF3Y:/rxXsNBdKJfUORz9n4cTz8PKF3Y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_fdopen
_fileno
_initterm
_lock
_setmode
_unlock
abort
calloc
exit
fclose
ferror
fflush
fgetc
fopen
fputc
fread
free
fwrite
localeconv
malloc
memcpy
memmove
memset
realloc
strerror
strlen
strncmp
ungetc
vfprintf
wcslen
BZ2_blockSort
BZ2_bsInitWrite
BZ2_bzBuffToBuffCompress
BZ2_bzBuffToBuffDecompress
BZ2_bzCompress
BZ2_bzCompressEnd
BZ2_bzCompressInit
BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit
BZ2_bzRead
BZ2_bzReadClose
BZ2_bzReadGetUnused
BZ2_bzReadOpen
BZ2_bzWrite
BZ2_bzWriteClose
BZ2_bzWriteClose64
BZ2_bzWriteOpen
BZ2_bz__AssertH__fail
BZ2_bzclose
BZ2_bzdopen
BZ2_bzerror
BZ2_bzflush
BZ2_bzlibVersion
BZ2_bzopen
BZ2_bzread
BZ2_bzwrite
BZ2_compressBlock
BZ2_crc32Table
BZ2_decompress
BZ2_hbAssignCodes
BZ2_hbCreateDecodeTables
BZ2_hbMakeCodeLengths
BZ2_indexIntoF
BZ2_rNums
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ